CVE detail
CVE-2023-34063
Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 20.8 · diversity 14.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
7 source links · newest first
- VMware fixed critical SQL-Injection in Aria Automation productSecurity Affairs
VMware addressed a critical SQL-Injection vulnerability, tracked as CVE-2024-22280, impacting Aria Automation. Virtualization giant VMware addressed a high-severity SQL-injection vulnerability, tracked as CVE-2024-22280 (CVSSv3 base score of 8.5), in its Aria Automation solution. VMware Aria Automation (formerly vRealize Automation) is a modern cloud automation platform that simplifies and streamlines the deployment, management, and governance of cloud infrastructure […]
newssecurityaffairs.comJul 11, 2024, 12:09 AM - 22nd January – Threat Intelligence ReportCheck Point Research
For the latest discoveries in cyber research for the week of 22nd January, please download our Threat_Intelligence Bulletin. TOP ATTACKS AND BREACHES Microsoft disclosed that they detected an attack against their systems by Russian state-sponsored actor known as Midnight Blizzard (aka Nobelium). The threat actor used a password spray attack to compromise a legacy non-production test […]
vendorresearch.checkpoint.comJan 22, 2024, 2:09 PM - Week in review: 10 cybersecurity frameworks you need to know, exploited Chrome zero-day fixedHelp Net Security
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Key elements for a successful cyber risk management strategy In this Help Net Security interview, Yoav Nathaniel, CEO at Silk Security, discusses the evolution of cyber risk management strategies and practices, uncovering common mistakes and highlighting key components for successful risk resolution. CISOs’ crucial role in aligning security goals with enterprise expectations In this Help Net Security interview, Chris Mixter, … More →
newswww.helpnetsecurity.comJan 21, 2024, 9:00 AM A critical vulnerability (CVE-2023-34063) affecting VMware Aria Automation and VMware Cloud Foundation can be exploited by attackers to gain access to remote organizations and workflows, VMware has warned. The company is not aware of any “in the wild” exploitation of this flaw – for now. Patches are available and VMware recommends upgrading to VMware Aria Automation 8.16. “This situation qualifies as an emergency change, necessitating prompt action from your organization,” they added. About CVE-2023-34063 VMware … More →
newswww.helpnetsecurity.comJan 18, 2024, 10:04 AMVMware has released updates for Aria Automation, its multi-cloud infrastructure automation platform for public, private and hybrid clouds, to fix a critical vulnerability that could allow authenticated attackers to access remote organizations and workflows. VMware Cloud Foundation, a suite of software-defined services for setting up private clouds, is also impacted if the products were deployed […]
newswww.csoonline.comJan 16, 2024, 9:31 PM- VMware fixed a critical flaw in Aria Automation. Patch it now!Security Affairs
VMware warns customers of a critical vulnerability impacting its Aria Automation multi-cloud infrastructure automation platform. VMware Aria Automation (formerly vRealize Automation) is a modern cloud automation platform that simplifies and streamlines the deployment, management, and governance of cloud infrastructure and applications. It provides a unified platform for automating tasks across multiple cloud environments, including VMware […]
newssecurityaffairs.comJan 16, 2024, 5:22 PM Aria Automation is affected by a critical vulnerability that could be exploited to gain access to remote organizations and workflows.
newswww.securityweek.comJan 16, 2024, 12:44 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2025-41231CVSS 7.3 · High
VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance may be able to perform certain unauthori…
- CVE-2025-22249CVSS 8.2 · High
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMw…
- CVE-2024-22280CVSS 8.5 · High
VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL que…
- CVE-2026-4672CVSS 4.3 · Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have…
- CVE-2026-14341CVSS 4.9 · Medium
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have…
- CVE-2026-16543CVSS 7.1 · High
Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration deni…